CVE-2025-26343
A CWE-1390 "Weak Authentication" in the PIN authentication mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to brute-force user PINs via multiple crafted HTTP requests.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.91%
- CWE
- CWE-1390
- Published
- 2025-02-12
- Last modified
- 2026-03-13
Affected products
- Q-Free MaxTime
Weakness type
Related vulnerabilities
- CVE-2026-77483 — SQL Server Elevation of Privilege Vulnerability
- CVE-2026-73025 — Windows iSCSI Security Feature Bypass Vulnerability
- CVE-2026-62895 — Azure Arc SQL Server Extension Elevation of Privilege Vulnerability
- CVE-2026-80219 — Hawtio-operator: hawtio-operator: oauthclient created with grantmethod auto and no secret enables oauth token theft
- CVE-2026-73819 — Ebyte NA111-M Weak Authentication
- CVE-2026-44476 — Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret
- CVE-2026-65098 — NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an...
- CVE-2026-68067 — Mira Hormone Monitor, Mira Android App Weak Authentication